EUVD-2026-104717
GHSA-66jj-58cw-683m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun malicious or buggy app locally
-
ExploitRepeatedly invoke racy code path
-
ExecutionWin timing race in unlocked critical section
-
ImpactTrigger unexpected system termination
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already execute an application on the target macOS system (AV:L, PR:L) and to repeatedly trigger and win a timing race in the improperly-locked code path (AC:H), which is probabilistic and non-deterministic - a significant limiting factor. There is no network vector and no user interaction. Impact is limited to availability (unexpected system termination); there is no confidentiality or integrity effect. This is fixed in macOS Golden Gate 27, so all macOS versions below 27 are affected until patched. |
| Impact | This is a genuinely low-priority issue despite a MEDIUM CVSS of 4.7, and the available signals are consistent rather than conflicting. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a locally-exploitable race condition requiring an already-running app with some privilege, non-trivial timing to win (AC:H), and yielding only availability impact (system termination) with no confidentiality or integrity loss. EPSS is very low at 0.14% (3rd percentile), the CVE is NOT on CISA KEV, and no public exploit was identified. CISA SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial. All independent signals agree this is a low-real-risk, denial-of-service-only flaw: a local attacker (or malicious/buggy app) could crash the machine, but cannot steal data, execute code, or escalate. The only caveat is that the attacker must already be able to run code on the host, so this is a reliability/robustness fix rather than a security-critical one. |
| Exploit ScenarioDerived | A malicious or malfunctioning application already running on a macOS host repeatedly triggers the vulnerable code path, winning a timing race in the improperly-locked critical section to force a kernel/system-level inconsistency. The result is an unexpected system termination (kernel panic / crash), denying service until reboot. No public exploit code was identified, and the high timing complexity (AC:H) makes reliable triggering non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Unexpected system termination in Apple macOS can be triggered by a locally executed app that repeatedly hits a timing race inside a code path protected by insufficient locking. All macOS releases below macOS Golden Gate 27 are affected, and the vendor has shipped a fix in macOS Golden Gate 27. Impact is availability-only (no confidentiality or integrity effect), and the attack path is narrow: the attacker must already be running code on the host and must win a probabilistic, non-deterministic race condition, which keeps real-world risk low - EPSS is 0.14% (3rd percentile), CISA SSVC records exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, with no KEV listing.
RemediationAI
Vendor-released patch: upgrade to macOS Golden Gate 27, which Apple shipped to close this race condition with improved locking; the fix and Apple's advisory are at https://support.apple.com/en-us/149035, and administrators should stage the upgrade through standard macOS update channels rather than deferring it, since every release below 27 remains affected. Because the only prerequisite is that an attacker can execute an app on the host, the practical compensating control while patching is to restrict execution of untrusted or unsigned applications - enforce Gatekeeper and notarization checks, keep users off administrative accounts, and limit third-party software installation to vetted sources; the trade-off is reduced user flexibility and additional helpdesk overhead for legitimate software requests. Endpoint detection tuned to repeated crashes or unexpected reboots of the same host can flag attempted race exploitation, but this is detective only and does not prevent termination. No vendor-released patch exists for any macOS version below Golden Gate 27 other than that upgrade, and no additional independent workarounds are documented in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / race condition); Apple's advisory states the race condition was addressed with improved locking, meaning two or more execution contexts could interleave on a shared resource inside the kernel or a privileged system component, leaving state inconsistent and ultimately forcing the system down. The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H describes the exact shape of the flaw: the vector is local, not network-reachable; the attacker needs low-privileged code execution in the form of an app already running on the target; no user interaction beyond that app executing is required; and only availability is impacted because the successful outcome is an unexpected system termination rather than data disclosure or modification. The AC:H rating reflects that the race must be timed successfully, which is probabilistic and non-deterministic and therefore a significant limiting factor. Apple's own CPE entry (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) has no version bounds embedded, so EUVD's range of macOS versions from 0 up to but excluding 27 is the authoritative scope; the fixed release is macOS Golden Gate 27.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Requires locally running code (AV:L, PR:L) and winning a non-deterministic timing race (AC:H); only a crash results, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB